{"id":"68c49e63-9ea4-48d5-8f6b-b589cb11b892","arxiv_id":"2506.15271","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Synthetic suffix-completion data, plus a dual-classifier t-test calibration, enables Dataset Inference to detect training membership while avoiding the false positives caused by distribution shift.","lead":"This paper replaces the hard-to-obtain held-out dataset required for Dataset Inference with synthetic text generated from the suspect data itself, then uses a two-classifier calibration to separate real membership signals from generation artifacts. It matters because it could let content owners audit whether an LLM was trained on their data without needing a perfectly matched private sample.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Non-member p-values do not establish low false positives: StackExchange 0.06 contradicts the paper's >0.1 claim, and the Section 4.2 assumption that any ccomb advantage over ctext implies membership is unproven.","rationale":"The reader's conditional verdict is appropriate: the method is interesting and the experiments support it in the tested settings, but the paper does not establish the key identifiability assumption. My concern is the same one the reader identified as weakest: the dual-classifier difference test assumes that any advantage of ccomb over ctext is attributable to membership rather than to distribution shift. I make this concern more concrete by pointing to the specific non-member p-values in Table 4 (0.06, 0.07, 0.07, 0.09) that sit close to the 0.05 threshold, and to the internal contradiction with the text's claim that all non-member p-values are >0.1. The lack of repeated-seed variance and the per-dataset snippet-length selection amplify the risk that the reported false-positive control is not robust. Since the reader already assigned a conditional verdict, I do not propose changing the verdict; the concern strengthens the conditions that should be attached (error bars, repeated seeds, a direct test of the identifiability assumption), but does not move the verdict to reject or accept.","tokens_in":23113,"tokens_out":6741,"duration_ms":72018,"concrete_test":"Run a controlled non-member experiment: take a target model and a suspect set provably absent from training, then generate the synthetic held-out set with varying sampling temperatures (or LoRA ranks) so that the text-only classifier AUC increases from ~52% to ~60%. If the ccomb minus ctext AUC advantage grows with the text-only shift, the Section 4.2 identifiability assumption fails and the test is detecting distribution shift, not membership. Also recompute all non-member p-values in Table 4 across 20 random seeds and report the 5th/50th/95th percentiles; if any subset has more than 5% of seeds with p<0.05, the low-false-positive claim is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that the dual-classifier t-test separates members from non-members with high confidence and low false positives. The load-bearing assumption in Section 4.2 is that 'any performance advantage of the membership-aware classifier over the text-only classifier must arise from the presence of membership signals rather than distributional artifacts.' This is not justified. MIA(f(x)) is a deterministic function of x and f; when the suspect set (natural) and synthetic held-out set (generated) differ in distribution, the MIA features encode that same distribution shift in a different representation. A 2-layer GPT2 text classifier may not exhaustively capture the text distribution, so ccomb can beat ctext on non-member data purely by exploiting distribution shift through MIA features. The non-member rows of Table 4 are the only empirical control, and they are weak: StackExchange p=0.06, FreeLaw p=0.09, Github p=0.07, EuroParl p=0.07, PubMed Central p=0.11. Section 5.3 claims 'higher than 0.1 on all the non-member sets,' which is directly contradicted by the StackExchange row. With a 0.05 threshold and 15 datasets, the observed p-values are consistent with the null (no membership) rather than demonstrating a low false-positive rate; the test appears underpowered. Additionally, the paired t-test treats suffix pairs as independent, but pairs share prefixes and documents, likely overstating significance. The per-dataset snippet-length selection (Appendix C) is chosen to minimize text-classifier AUC on the evaluation data, further weakening the false-positive control. These issues mean the core claim of 'reliability for real-world litigation' is not established.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper addresses the held-out data bottleneck in Dataset Inference (DI) by proposing to synthesize a held-out set from the suspect dataset itself. The generator is trained on a suffix-completion task over segmented snippets, and a dual-classifier difference t-test compares a text-only classifier with a membership-aware classifier, attributing any performance difference to membership rather than distribution shift. Experiments on a single-author blog corpus and on 15 Pile subsets report low p-values for member sets and mostly non-significant p-values for non-member sets, with ablations showing that suffix completion, post-hoc calibration, and the weight constraint each contribute to performance. If the assumptions hold, this removes the requirement for a real in-distribution held-out set, which is the main obstacle to applying DI in copyright discovery.","tokens_in":23393,"tokens_out":7675,"duration_ms":69832,"significance":"If the method's central assumption is valid, this is a practically valuable contribution: it enables dataset inference without access to real in-distribution held-out data, directly addressing a key limitation of prior DI methods. The experimental breadth (single-author to multi-author, code, legal, medical, multilingual data) is substantial, the ablations are informative, and the authors ship code. However, the statistical validation of the low-false-positive claim is not yet convincing: several non-member p-values in Table 4 are close to the 0.05 threshold, and the justification that any advantage of the combined classifier over the text-only classifier must come from membership rather than distribution shift is not established. The central idea is promising, but the current evidence requires strengthening before the reliability claims can be accepted.","major_comments":[{"comment":"The key assumption that any performance advantage of the combined classifier ccomb over the text-only classifier ctext must arise from membership signals rather than distributional artifacts is not justified. MIA features are deterministic functions of x and f; when the suspect set (natural) and the synthetic held-out set (generated) differ in distribution, the MIA features encode that same shift, so ccomb can beat ctext on non-member data purely by exploiting distribution shift. Table 4 provides direct evidence: on non-member sets, AUC Comb exceeds AUC Text for FreeLaw (53.9 vs 51.4), Github (55.4 vs 53.9), EuroParl (53.9 vs 51.4), PubMed Central (55.5 vs 54.7), and StackExchange (55.0 vs 53.0). The corresponding p-values (0.09, 0.07, 0.07, 0.11, 0.06) do not establish a low false-positive rate; four of these five are below 0.1. The statement in Section 5.3 that p-values are \"higher than 0.1 on all the non-member sets\" is contradicted by StackExchange (0.06), FreeLaw (0.09), Github (0.07), and EuroParl (0.07). The authors should provide a control experiment with a genuinely in-distribution non-member held-out set, or otherwise demonstrate that the null distribution of their test is calibrated.","section":"Section 4.2, Eq. (2), and Table 4"},{"comment":"The paired t-test does not account for the fact that the two classifiers are trained once on the same training split and then evaluated on the same test pairs. The per-pair differences are therefore correlated rather than independent, likely inflating statistical significance. In addition, multiple test pairs derive from the same source document; Appendix C lists maximum snippets per document ranging from 5 to 2000, which introduces clustering by document. The description of the Sidak-corrected p-value aggregation across random seeds is too brief to be reproducible (number of seeds, how p-values are combined, and how ties are handled are unspecified). Exact p-values of 1.00 in many non-member rows of Table 4 are unexpected for a t-test and suggest an uncalibrated or degenerate test. A resampling-based test (e.g., bootstrapping at the document level, or a permutation test that refits the classifiers) would be more appropriate.","section":"Section 5.5 and Eq. (2)"},{"comment":"The per-dataset choice of sequence length and maximum snippets per document is made by minimizing the AUC of the text classifier on the very suspect and synthetic data that are later used in the DI test. This constitutes tuning on the evaluation data: it can make the text classifier artificially weak, thereby biasing the comparison in favor of the combined classifier. The sensitivity analysis in Appendix K varies the number of epochs and the sample size, but not these two key generation hyperparameters. The authors should either provide a fixed protocol for selecting these values (e.g., from a separate development set or from the generator's validation loss) or demonstrate that the conclusions are robust to a range of these choices.","section":"Appendix C and Section 4.1"}],"minor_comments":[{"comment":"The claim that p-values are \"higher than 0.1 on all the non-member sets\" is directly contradicted by Table 4; the sentence should be corrected to state the actual range and to discuss the borderline cases.","section":"Section 5.3"},{"comment":"The caption refers to \"MeanDataset\" but defines it as \"the maximum p-value of all subsets\"; this is likely a typo for \"MaxDataset\".","section":"Figure 5 caption"},{"comment":"The sentence \"we 1 first segment\" contains a stray \"1\" and should read \"we first segment\".","section":"Section 4.1"},{"comment":"The notation \"wi∈R\" should use mathbb, i.e., w_i \\in \\mathbb{R}; also, the equation formatting for expectations could be improved for readability.","section":"Section 4.3, Eq. (3)"},{"comment":"The example in the text completion prompt contains a stray token \"pneumoniae.\" that appears out of place and should be removed or clarified.","section":"Appendix A.1"},{"comment":"The AUC values are reported as point estimates without standard errors or confidence intervals; given the small differences (often 1–4 AUC points), reporting variability across the random seeds would help the reader judge effect sizes.","section":"Tables 3 and 4"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses an important and timely problem, and the experimental scope is impressive. The main concerns are the unproven assumption in Section 4.2, the statistical validity of the paired t-test, and the fact that a clear quantitative claim in Section 5.3 is false as stated. These issues are fixable with additional control experiments and a more careful statistical analysis, so I do not think rejection is warranted. I would encourage the authors to re-analyze the non-member rows, correct the overstatement, and clarify the hyperparameter selection protocol."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Look, this is a real step forward for Dataset Inference. The basic bottleneck—needing an in-distribution held-out set that practically doesn't exist—is the thing that's kept DI theoretical, and this paper attacks it directly with a concrete, reproducible recipe: train a suffix-completion generator on the suspect data, synthesize a held-out set, then run a dual-classifier t-test to separate membership signal from generation shift. That is a genuinely useful contribution, and they back it with code and reasonably extensive experiments across a bunch of Pile subsets and model sizes.\n\nThe ablations are honest and informative—they show the baselines (ICL paraphrase, preference optimization) fail because of distribution shift, and the weight constraint makes a measurable difference. The negative result in Section 3 showing standard DI false-positives on tightly matched single-author blogs is a good data point.\n\nBut there are real problems. First, the paper claims \"higher than 0.1 on all non-member sets\" in Section 5.3. Table 4 shows StackExchange 0.06, FreeLaw 0.09, Github 0.07, EuroParl 0.07, PubMed Central 0.11. That is a factual error, not a typo—it misdescribes the main false-positive control evidence. Second, the Section 4.2 assumption that any advantage of the combined classifier over the text classifier must come from membership is not justified. When natural and synthetic data differ, the MIA features inherit that distribution shift; a c_comb advantage could in principle reflect the shift being more easily decodable in MIA space. The synthetic generator is trained on the same suspect data, so the method is self-referential, and the paper doesn't offer a theoretical argument that the shift cancels. The empirical non-member p-values are the only control, and they're weaker than claimed. Third, the snippet-length selection per dataset (Appendix C) is tuned to minimize text-classifier AUC on the evaluation data; that's fitting the evaluation setup. Fourth, the paired t-test treats suffix pairs as independent even though they share prefixes and documents, which likely overstates the p-values' significance. And there are no repeated-seed error bars on the AUC differences.\n\nNone of this destroys the core result. The member-set p-values are uniformly tiny, the method is clearly doing something right, and the code is a plus. But the paper oversells its reliability for real-world litigation, and the statistical reporting needs work.\n\nSend it to peer review with a request for revisions: fix the non-member summary, justify or soften the Section 4.2 assumption, report variance across seeds, and either drop the per-dataset hyperparameter tuning or show it doesn't drive the results. I'd bring it to reading group; I'd probably cite it for the synthetic-data idea.","headline":"A genuinely useful practical contribution to Dataset Inference that deserves a serious referee, but the paper overstates its false-positive control and needs a statistical cleanup before its litigation claims are credible.","tokens_in":23983,"tokens_out":2922,"would_cite":true,"duration_ms":27681,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Dataset inference can detect unauthorized training data using a synthetic held-out set generated from the suspect texts themselves, provided the natural-versus-synthetic shift is separated from membership by a dual-classifier t-test.","keywords":["dataset inference","membership inference attacks","synthetic held-out data","suffix completion","post-hoc calibration","large language models","copyright protection","false positive rate"],"falsifier":"Run the complete pipeline on a non-member suspect set used to train the generator and both classifiers, repeating the paired t-test over many random splits; any rejection of the null at $p<0.05$ would show the method is detecting generation artifacts rather than membership. The paper's own Setting 6 shows that the uncalibrated t-test already produces false positives on non-member sets, so the decisive experiment is the same non-member corpus with the full calibration held fixed.","tokens_in":22881,"feed_emoji":"⚖️","tokens_out":9221,"duration_ms":84979,"temperature":0.7,"pith_summary":"Dataset inference (DI) tries to determine whether a specific dataset was used to train a model, but established methods require a held-out set from the same distribution that is known to be absent from training—data that rarely exists in practice. The paper claims this bottleneck can be removed by generating the held-out set from the suspect texts themselves: a generator is fine-tuned on shuffled, segmented versions of the suspect data and completes shared prefixes, producing synthetic suffixes that are nearly indistinguishable from the real ones. It then adds a post-hoc calibration step in which a text-only classifier and a combined classifier (text plus the target model's membership-inference scores) are compared; any advantage of the combined classifier is counted as membership signal rather than generation artifact. On single-author blog posts and sixteen Pile subsets, member sets are detected with $p<0.05$ and non-member sets stay above threshold, so the paper concludes that DI becomes usable for copyright owners without a private in-distribution corpus.","feed_headline":"No held-out data? Generate it and detect training membership","feed_subtitle":"Synthetic suffixes plus a two-classifier test separate membership from distribution shift, cutting false accusations.","key_machinery":"The load-bearing object is the suffix-completion generator used together with the dual-classifier difference t-test. The generator is a LoRA-finetuned LLM trained on the suspect texts after they are segmented into short sequences and randomly split, and it writes a synthetic continuation for each prefix; because original and synthetic suffixes share a prefix, they can be compared pair by pair. Two classifiers are then trained on the same suspect and held-out splits: $c_{\\mathrm{text}}(x)$ sees only the text, while $c_{\\mathrm{comb}}(x,\\mathrm{MIA}(f(x)))$ also sees membership-inference scores from the target model. The test statistic compares $c_{\\mathrm{comb}}(x_{\\mathrm{val}})-c_{\\mathrm{comb}}(x_{\\mathrm{sus}})$ with $c_{\\mathrm{text}}(x_{\\mathrm{val}})-c_{\\mathrm{text}}(x_{\\mathrm{sus}})$, and only the combined classifier's extra edge is treated as membership evidence. A Sigmoid projection keeps the MIA weights in $(0,1)$ so that generated-text perplexity gaps cannot be summed into a false positive.","core_discovery":"The central claim, stated as the authors would state it, is that a synthetic held-out set generated from the suspect data itself can replace the missing in-distribution held-out set in dataset inference, provided the generation shift is measured and removed. The key construction is pairwise: each original suffix in the suspect set is paired with a synthetic suffix produced by a LoRA-finetuned generator from the same prefix, so the two texts differ only in continuation, not position. A text classifier trained on real-versus-generated suffixes captures the generation gap; a combined classifier that also receives the target model's MIA scores should beat the text classifier only when the suspect set was in training. The paper's difference comparison t-test formalizes this comparison, and the positive weight constraint stops perplexity-based MIA scores from pooling generation artifacts into a false signal. The paper reports that this procedure detects membership on every evaluated member set and refrains from accusing on every evaluated non-member set.","pith_inferences":["This suggests the same dual-classifier logic could transfer to images, code, or audio, whenever a generator can be fine-tuned on the suspect set; the paper only tests text.","A natural stress test the paper does not run is adversarial selection of the suspect set to mimic the target model's public training distribution, which would probe whether the calibration survives a deliberate false-accusation attempt.","The paired suffix design also points to a cheap contamination-screening use: a few thousand target-model queries could flag whether a benchmark appeared in training, without any user-supplied held-out data."],"forward_implications":["A data owner can run dataset inference with only the suspect documents and black-box access to the target model, because the held-out set is generated on demand instead of being supplied privately.","Member detection reaches $p<0.05$ on every Pile subset tested, while non-member p-values stay above $0.1$, giving a concrete operating point for copyright discovery.","Statistical confidence grows with sample size: fewer than 1,000 paired samples reach significance on most datasets, and 2,000 samples give $p<0.01$ consistently.","The positive weight constraint alone changes false-positive outcomes on non-member sets, so the calibration logic can be reused as a guard against generation-induced MIA gaps."],"supporting_citations":[{"why":"Defines dataset inference and its hypothesis-testing procedure, which the paper inherits as the detection framework.","marker":"Maini et al., 2021"},{"why":"Provides the LLM-specific DI setup—linearly weighted MIA scores per sample—that the post-hoc calibration extends.","marker":"Maini et al., 2024"},{"why":"Supplies the classifier-AUC distribution-gap metric and the blind-baseline idea used to measure real-versus-generated shift.","marker":"Das et al., 2024"},{"why":"Introduces the debiasing idea of comparing text-only and text-plus-model signals, which the dual-classifier t-test builds on.","marker":"Kazmi et al., 2024"},{"why":"Documents the distribution-shift failure mode of membership inference that motivates replacing user-supplied held-out data with synthetic data.","marker":"Zhang et al., 2024a"},{"why":"Shows correctly evaluated MIAs are near chance, justifying the strict one-epoch fine-tuning regime used in the experiments.","marker":"Duan et al., 2024"},{"why":"Defines the Pythia family of target models used for the single-author and Pile evaluations.","marker":"Biderman et al., 2023"},{"why":"Provides the Llama-3 base model that is LoRA-tuned as the suffix-completion generator.","marker":"Dubey et al., 2024"},{"why":"Supplies the Pile dataset and its subsets used to test the method across domains.","marker":"Gao et al., 2020"}],"fun_headline_variants":["Synthetic held-out data unlocks dataset membership tests","No held-out set? Generate one and infer training use","Post-hoc calibration lets synthetic data stand in for real","Detect training data by generating a synthetic held-out set","Synthetic suffixes + calibration expose training membership"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the membership signal of the suspect set remains visible in the target model's membership-inference scores after the generator has been trained on the same texts, and that the combined classifier's advantage over the text-only classifier comes from that signal rather than from a distribution-based shortcut.","fun_headline_variants_meta":{"raw":{"variants":["Synthetic held-out data unlocks dataset membership tests","No held-out set? Generate one and infer training use","Post-hoc calibration lets synthetic data stand in for real","Detect training data by generating a synthetic held-out set","Synthetic suffixes + calibration expose training membership"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000648,"raw_usage":{"total_tokens":2987,"prompt_tokens":970,"completion_tokens":2017,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":586,"completion_tokens_details":{"reasoning_tokens":1952}},"tokens_in":586,"tokens_out":2017,"duration_ms":16416,"temperature":1.0,"reasoning_tokens":1952,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:36:29.112181+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the complete pipeline on a non-member suspect set used to train the generator and both classifiers, repeating the paired t-test over many random splits; any rejection of the null at $p<0.05$ would show the method is detecting generation artifacts rather than membership. The paper's own Setting 6 shows that the uncalibrated t-test already produces false positives on non-member sets, so the decisive experiment is the same non-member corpus with the full calibration held fixed.","supporting_citations":[{"cited_title":"Dataset inference: Ownership resolution in machine learning","cited_arxiv_id":null,"evidence_quote":"Defines dataset inference and its hypothesis-testing procedure, which the paper inherits as the detection framework."},{"cited_title":"PANORAMIA : Privacy auditing of machine learning models without retraining","cited_arxiv_id":null,"evidence_quote":"Introduces the debiasing idea of comparing text-only and text-plus-model signals, which the dual-classifier t-test builds on."}],"review_version":1}